diff --git a/databricks_cli/configure/cli.py b/databricks_cli/configure/cli.py
index 5242b63b..788f5f2f 100644
--- a/databricks_cli/configure/cli.py
+++ b/databricks_cli/configure/cli.py
@@ -38,8 +38,14 @@
 
 def _configure_cli_token(profile, insecure):
     config = ProfileConfigProvider(profile).get_config() or DatabricksConfig.empty()
+    if config.token:
+        default_token = '*' * len(config.token)
+    else:
+        default_token = None
     host = click.prompt(PROMPT_HOST, default=config.host, type=_DbfsHost())
-    token = click.prompt(PROMPT_TOKEN, default=config.token)
+    token = click.prompt(PROMPT_TOKEN, default=default_token, hide_input=True)
+    if token == default_token:
+        token = config.token
     new_config = DatabricksConfig.from_token(host, token, insecure)
     update_and_persist_config(profile, new_config)
 
diff --git a/databricks_cli/configure/provider.py b/databricks_cli/configure/provider.py
index 24a7fa3b..dd865063 100644
--- a/databricks_cli/configure/provider.py
+++ b/databricks_cli/configure/provider.py
@@ -216,6 +216,8 @@ def get_config(self):
 class ProfileConfigProvider(DatabricksConfigProvider):
     """Loads from the databrickscfg file."""
     def __init__(self, profile=DEFAULT_SECTION):
+        if profile is None:
+            profile = DEFAULT_SECTION
         self.profile = profile
 
     def get_config(self):
diff --git a/tests/configure/test_cli.py b/tests/configure/test_cli.py
index bf74ac16..64bf1832 100644
--- a/tests/configure/test_cli.py
+++ b/tests/configure/test_cli.py
@@ -26,7 +26,7 @@
 from click.testing import CliRunner
 
 import databricks_cli.configure.cli as cli
-from databricks_cli.configure.provider import get_config, ProfileConfigProvider
+from databricks_cli.configure.provider import get_config, ProfileConfigProvider, get_config_for_profile, DEFAULT_SECTION
 
 TEST_HOST = 'https://test.cloud.databricks.com'
 TEST_USER = 'monkey@databricks.com'
@@ -57,6 +57,13 @@ def test_configure_cli_token():
     assert get_config().token == TEST_TOKEN
     assert get_config().insecure is None
 
+    stdout = runner.invoke(cli.configure_cli, ['--token'],
+                  input=(TEST_HOST + '\n' + '\n')).stdout
+    assert TEST_TOKEN not in stdout
+    assert len(TEST_TOKEN) * '*' in stdout
+    assert get_config().host == TEST_HOST
+    assert get_config().token == TEST_TOKEN
+
 
 def test_configure_two_sections():
     runner = CliRunner()